CVE-2025-24984
Published: 11 March 2025
Summary
CVE-2025-24984 is a medium-severity Insertion of Sensitive Information into Log File (CWE-532) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 13.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-9 (Protection of Audit Information) and PE-3 (Physical Access Control).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediates the specific flaw in Windows NTFS that inserts sensitive information into the log file, eliminating the vulnerability as recommended in Microsoft's update guide.
Enforces physical access controls to prevent unauthorized attackers from gaining the physical access required to disclose sensitive information from the NTFS log file.
Protects the log file containing sensitive information from unauthorized access, directly mitigating disclosure risks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability causes sensitive information to be logged in an NTFS log file, enabling an attacker with physical access to collect confidential data directly from the local system.
NVD Description
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
Deeper analysisAI
CVE-2025-24984 is a vulnerability in the Windows NTFS file system that involves the insertion of sensitive information into a log file, classified under CWE-532. Published on 2025-03-11, it carries a CVSS v3.1 base score of 4.6 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting a medium-severity issue where sensitive data exposure occurs via physical means.
An unauthorized attacker with physical access to the affected system can exploit this vulnerability with low attack complexity, requiring no privileges, user interaction, or scope changes. Exploitation enables high-impact disclosure of confidential information from the log file, without impacting integrity or availability.
Microsoft's update guide addresses mitigation for CVE-2025-24984 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984. The vulnerability is also listed in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24984.
Details
- CWE(s)
- KEV Date Added
- 11 March 2025